File size: 2,842 Bytes
ef6eb55 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 | # PAX-Coder Phase 2: ADR-Governed Verification & Authorization
**Status:** In Progress
**Started:** 2026-08-18
**Goals:**
1. Refactor verify-clone for ADR-0001 (integrity-only, no authorization logic)
2. Create verify-release for ADR-0002 (explicit authorization boundary)
3. Add test suite (6 tests minimum)
4. Enable CI gate enforcement
---
## Step 1: Refactor verify-clone (ADR-0001)
**Current:** Mixed integrity + authorization logic
**Target:** Pure integrity verification, non-destructive, repeatable
Changes:
- Remove any authorization checks
- Explicit success/failure only
- All 9 checks pass independently
- No degraded mode on partial verification
- Output stable across runs
**Key invariant:** Run twice, get same result both times
---
## Step 2: Create verify-release (ADR-0002)
**New script:** verify-release
**Purpose:** Explicit authorization boundary
Design:
- Phase 1: Integrity check (calls verify-clone)
- Phase 2: Authorization check (separate function)
- Requires server capability OR held secret
- Returns AUTHORIZATION_REQUIRED if missing
- Clear error message
- No fallback execution
**Example output:**
```
INTEGRITY_VERIFIED: Clone is authentic
AUTHORIZATION_REQUIRED: Protected operation requires external capability
→ Contact release authority for authorization token
→ See: docs/adr/0006-server-challenge-protocol.md
```
---
## Step 3: Test Suite
6 tests minimum:
1. test_integrity_verification_independent
2. test_authorization_required_for_protected_ops
3. test_modified_file_detected
4. test_signature_validation
5. test_no_silent_corruption
6. test_private_key_not_distributed
Location: scripts/test_verification.sh
---
## Step 4: CI Enforcement
Add to .github/workflows/adr-validation.yml:
- Run verify-clone on every commit
- Reject if integrity fails
- ADR compliance check
---
## ADR Constraints During Phase 2
From ADR-0007 (Codex Security Preservation):
- ✓ Read applicable ADRs first
- ✓ Pass CI validation
- ✓ Preserve existing artifacts (all 55 files)
- ✓ Document security claims clearly
- ✗ Do not silently ignore violated ADRs
- ✗ Do not delete or rename artifacts
- ✗ Do not implement unspecified security properties
---
## Success Criteria
- [ ] verify-clone output stable (run twice = same result)
- [ ] verify-release has explicit authorization boundary
- [ ] All 6 tests pass
- [ ] No files deleted or weakened
- [ ] ADR constraints maintained
- [ ] CI can enforce ADR violations
- [ ] Documentation updated
---
## Commits
Will create new commits for:
1. verify-clone refactor
2. verify-release implementation
3. test suite
4. CI configuration
Each commit includes verification that ADR constraints are maintained.
|